Azure / Azure/azure-quickstart-templates

SAS token in template linked URL logged

Open
#1,986 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Bicep
Stars
14.9k
Forks
16.2k
Avg merge
6d 21h
Merged PRs (30d)
6

Description

I use SAS tokens to deploy linked templates and keep the templates private. The full template URL (including the SAS token) ends up in the deployment log info. Please remove the SAS token query parameters from the log info. My secureString parameter should not end up in the logs!

Here is the template I am deploying

``` javascript
{
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0",
"parameters": {
"params": {
"type": "Object"
},
"_templateSasToken_": {
"type": "SecureString"
},
"_templateContainer_": {
"type": "String"
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.Resources/deployments",
"name": "20160520-201610-template",
"apiVersion": "2016-02-01",
"properties": {
"templateLink": {
"uri": "[concat(parameters('_templateContainer_'), '1.0.0/template.json', parameters('_templateSasToken_'))]"
},
"parameters": {
"name": {
"value": "[parameters('params').name]"
},
"location": {
"value": "[parameters('params').location]"
}
},
"mode": "incremental"
}
}
]
}
```

Let me know if there is a more appropriate place to report issues like this in the future. Thanks!

Contributor guide

No contributing guide indexed for this repository

Research direction

No repository file, test, or entry point is named. Start by reproducing the Azure linked-template deployment with the supplied ARM template, inspect the deployment log entry containing the template URL, and consider the issue done when SAS query parameters and secure values no longer appear there.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.